Adds support for Arm Trusted Firmware-A version v2.0.

The qemu platform in TF-A v2.0 does not acccept MULTI_CONSOLE=0 anymore,
so remove it. The current version v1.5 is quite happy without it already.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

Use two vCPUs by default instead of one. This configuration is more
likely to trigger race conditions when testing.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Plain upstream kernel v4.19 now supports HiKey960 well enough, so we do
not need to use the 96boards repository anymore [1]. Setting a few config
symbols is needed however, otherwise the kernel can not boot our
buildroot-generated root FS. This commit introduces the required symbols
so that we can later drop the 96boards branch (when we rebase our optee
branch [2] onto v4.19). Note that having these symbols enabled is OK with
the current branch, too.

Link: [1] https://github.com/96boards-hikey/linux
Link: [2] https://github.com/linaro-swg/linux/tree/optee


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

common.mk mistakenly uses the QEMU overlay (which currently contains
only an init script for udhcpc) on all platforms. This is incorrect and
causes problems on RPi3 at least [1].

Fixes: commit 751b35bb ("qemu: buildroot: fix networking")
Links: [1] https://github.com/OP-TEE/optee_os/issues/2478#issuecomment-432818199


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

1. Remove usage of hikey.conf for kernel config
2. Change CFG_DRAM_SIZE_GB to 1
3. Add creation of out directory

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Use Arm's GCC 8.2 toolchains.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Using the current tip of the buildroot upstream branch, we get the
following error:

 build$ make
 [...]
 [...]br-ext/package/optee_benchmark/optee_benchmark.mk:8: *** optee_benchmark has local site method, but `OPTEE_BENCHMARK_SITE` is not defined.  Stop.

The error does not occur if BR2_PACKAGE_OPTEE_BENCHMARK is selected (i.e.,
"make CFG_TEE_BENCHMARK=y").

It looks like the _SITE variable has to be declared even though the
package is not selected for building.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

The Device Tree configuration we need for the Foundation Platform is now
available upstream (v4.18) as foundation-v8-gicv3-psci.dts (it only lacks
the optee node and memory reservations). Let's use this new file instead
of a hacked version of foundation-v8.dts modified for PSCI and GiCv3.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

If /dev/ion exists, it should be set up so that the test user can access
it. Otherwise, some tests will fail, such as xtest 1014 (Secure Data
Path). Similar to what is done for /dev/tee*, this commit configures
permissions based on a specific group: ion.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

1. Switch to upstream ARM Trusted Firmware and U-boot.
2. Change the ATF+OP-TEE booting sequence.

Now the booting sequence looks like:
VideoCore IV bootloader -> ATF + OP-TEE payload -> U-boot -> Linux kernel

Reviewed-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Fixes #271

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Restrict execution of TEE client applications to members of the teeclnt
group. A test user is created and added to this group.
Having two groups (tee and teeclnt) allows to better isolate
tee-supplicant from the client applications.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Build with GDBSERVER=y to enable remote debugging of Normal World
applications. gdbserver is added to the root filesystem.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Create user and group tee/tee and set the proper permissions on /dev/tee*
and /data/tee so that tee-supplicant and the client applications may be
run as a non-root user.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Init scripts normally print OK or FAIL when they start daemons. Update
our tee-supplicant script to do just that. The -d option to tee-supplicant
is used so that when the tee-supplicant command returns, we  know for sure
if initialization went well or not.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Adds the missing startup file to the buildroot-generated filesystem so
that networking is available in the VM as claimed by docs/qemu.md.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Now that buildroot is used, the 'mount_shared' alias is not available
anymore. Document the full command instead.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

Tested-by: Igor Opaniuk <igor.opaniuk@linaro.org>
Reviewed-by: Igor Opaniuk <igor.opaniuk@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

The files used by "make recovery" have been renamed [1].

Link: [1] https://github.com/96boards-hikey/tools-images-hikey960/commit/b5ae2c13438e


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Provide proper value to optee_client cmake option
CFG_TEE_BENCHMARK

Acked-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Grub 2.02 has a harmless warning with recent GCC compilers. Avoid the
problem by configuring Grub with --disable-werror.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

1. Add initial poplar.mk, not integrated with buildroot yet.
2. Configure travis to build poplar setup
3. Add poplar as supported build platform to README.md

Reviewed-by: Victor Chong <victor.chong@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Currently sign.py uses system python to sign TAs. Problem is
that buildroot can build own host-python. This python lacks
pycrypto, so sign.py fails.

This patch adds dependency on host-python-pycrypto, so buildroot
will always build python with needed module.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

As for qemu.mk, environment can set the number of cores to be emulated
using QEMU_SMP. Defaults to 1 core.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMUv8, FVP, RPi3)
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>